Questions tagged [enumeration]
Pre-attack is a phase where an attacker attempts to discover information about their target. This can involve network reconnaissance, operational intelligence, historical information, etc.
54
questions
0
votes
0
answers
44
views
Enumerate Golang net/rpc Port?
I'm playing with a web app CTF for fun/learning. The backend is using Golang's net/rpc library to provide frontend access to what I think are database operations. The problem is I don't know what the ...
- 1
1
vote
0
answers
126
views
Is it possible to enumerate registered eepsite (I2P) subdomains?
Eepsites are similar to Tor's hidden services, but based on the I2P anonymity network.
Named eepsites use central registrars like stats.i2p and no.i2p. Each eepsite also has a b32 domain which is a ...
- 66.3k
0
votes
1
answer
41
views
Exploitation Risks and Considerations specific to running internal DNS servers
I have heard of larger companies are utilizing their own internal DNS servers to route through internal resources. And was wondering if there is any specific exploitation risks and considerations for ...
- 726
0
votes
0
answers
63
views
Is Reading Windows Reserved Filenames Through a URL Valid for OS Enumeration?
I'm aware that writing a file with a reserved name such as CON.txt or CON.mp3, aux.txt, lpt1.html, etc. is not allowed by Windows and can be leveraged for enumeration.
However, what about reading a ...
1
vote
1
answer
189
views
DNS reverse lookup not finding domain name during enumeration
While enumerating a DNS server for a HTB machine, I've tried finding a domain name for 127.0.0.1:
┌──(kali㉿kali)-[~]
└─$ dig -x 127.0.0.1 @10.10.11.166
; <<>> DiG 9.18.1-1-Debian <<...
- 113
1
vote
0
answers
530
views
How to get the list of computers a user can RDP into using BloodHound?
Using bloodhound I would like to find the list of all computers a user I.e "domain\ajohn" can RDP into.
I looked at:
match p=(g:Group)-[:CanRDP]->(c:Computer) where g.objectid ENDS WITH '-...
- 11
0
votes
1
answer
244
views
DNS Enumeration by IP Address
I know all baseline steps to do DNS enumeration over a domain. But my questions is: how can I enumerate a server when I do not know which domain it is managing and I only have its IP address?
My ...
- 1
3
votes
2
answers
269
views
Mail gateway allowing telnet connections
Our organization is currently being tested by a IT security firm who have stated that while our internet facing mail gateway is not an open relay, they can connect to it on port 25 using telnet and ...
- 31
0
votes
1
answer
353
views
Verifying IP addresses during pentest
When conducting an external pentest and the scope is broad covering everything owned by the client, how would you verify if the enumerated IP addresses belong to a client? Running 'nslookup' on the IP ...
- 155
0
votes
1
answer
146
views
How to enumerate PGP keyring e-mails related to a specific ccTLD
I would like to enumerate all possible PGP e-mails related to North Korean top-level domain .kp
Few years ago I would have used theHarvester but I recently discovered that this useful tool doesn't ...
2
votes
1
answer
277
views
Rate Limit DNS Subdomain Requests
I work at a company that provides a SaaS program for other organizations, and each subscribed organization receives their own subdomain of their choosing - generally they choose the organization name. ...
- 123
1
vote
1
answer
351
views
SNMP Enumeration
I'm scanning a machine that has the UDP port 161 open and I'm not able to run snmpwalk against it as I'm returned with the error:
Timeout: No Response from <IP>
I tried to run the onesixtyone ...
- 11
1
vote
1
answer
155
views
Directories enumeration by errors. CVSS3.1 and remediation
Let's consider this scenario.
If I browse to https://www.example.com/existentdirectory the web application shows this error "directory listing is denied".
If I browse to https://www.example....
- 567
1
vote
1
answer
2k
views
AutoRecon is taking too long to complete
AutoRecon is a multi-threaded network reconnaissance tool which
performs automated enumeration of services. It is intended as a
time-saving tool for use in CTFs and other penetration testing
...
- 367
1
vote
1
answer
2k
views
using Uuid for security
I read that uuid does not bring any security advantages
But I can't find why It doesn't bring a little bit of extra security in the scenario below ?:
Consider that right now the session id is ...
- 13
0
votes
0
answers
112
views
Username enumeration with multiple inputs
Consider the case of username enumeration, where a hacker is able to determine a username based on UI feedback being different from a successful entry vs a failed entry.
For example, a website's ...
1
vote
1
answer
3k
views
How to prevent Directory Enumeration Attacks (DirB or Directory Buster)
I am dabbling in pen testing (OWASP Juice Shop) and I realized many web application attacks start from enumeration where the attacker uses DirB to find vulnerable Web Objects or Directories to attack ...
- 11
1
vote
1
answer
976
views
It is possible to enumerate/discover IIS applications from outside?
I wonder if it is possible that someone, from the Internet, could be able to discover services provided via IIS by knowing only the IP address.
If yes, how? And how can I protect my IIS from this ...
- 21
2
votes
0
answers
113
views
How do scanners know which apache2 modules are installed?
My machines routinely get scanned by Qualys and other scanners that report my supported and patched version of php as wildly out of date (even though they're patched quarterly, I get flagged on ...
- 141
2
votes
1
answer
88
views
Periods in Common Platform Enumeration WFN (NIST Interagency Report 7695 )
I’m looking at NIST Interagency Report 7695 and the grammar described in 5.3.2 seems to say that all . need to be preceded by a \, but this doesn’t seem to be followed in the CPE dictionary. Am I ...
- 131
0
votes
1
answer
182
views
Enumerating hosts running Elastic Stack
I am currently working on a project where I need to find a host running a SIEM solution. From my research I am fairly confident that the host is running Elastic Stack, probably within another solution ...
- 23
2
votes
1
answer
1k
views
List of common website endings/pages for enumeration? [closed]
I am currently building a Python-based OSINT tool that allows a user to crawl a supplied domain for pages using traditional scraping/spider methods, but I also want to have the option to 'brute force' ...
- 672
0
votes
1
answer
170
views
How to determine all public IP adresses from within an organization?
I can determine a single public IP address from within the organization (using NAT) by sending a HTTP request to one of the publically available services:
curl ipinfo.io/ip
However, if my request ...
- 1,197
3
votes
1
answer
9k
views
How I can enumerate all endpoints of an API?
Let's say I have an API api.example.com and I want to test all endpoints. I don't have access to documentation, how I can enumerate all the endpoints?
- 149
10
votes
2
answers
1k
views
How do exploit kits enumerate or fingerprint their targets?
My current understanding is that an exploit kit will fingerprint (gather information on) a system, check those details against a database of vulnerabilities and then attempt to use the relevant ...
- 1,489
3
votes
1
answer
127
views
To what extent should we defend against leaked credentials being tested against our system?
We see these kinds of attempts with some frequency. Normally a leak has happened from some other 3rd party, and an attacker has a big list of known account + password combinations that they can try ...
- 131
0
votes
1
answer
898
views
how to do internal subdomain enumerations in corp network?
I need to figure out a good way to do internal subdomain enumerations in corp network? My goal is to find the list of internal subdomains in my organizations. I tried https://github.com/TheRook/...
- 41
4
votes
1
answer
2k
views
Can someone explain me the DNSSEC NSEC3 output?
I'm trying to understand how NSEC and NSEC3 records work in DNSSEC. When I query for an non-existent domain with supports NSEC3, I get the following output
$ dig +dnssec NSEC3 gggg.icann.org. | grep -...
- 41
3
votes
2
answers
753
views
What is the key to detecting all IoT devices in your organization? [closed]
In recent news, IoT devices are a target of hackers -- specifically botnet herders. The first step to securing your organization and its users is to detect all IoT devices that are functional on your ...
- 1,366
1
vote
2
answers
6k
views
Discover Hidden WiFi SSID
How to discover hidden SSIDs ? I know there are tool like WiGLE WiFi (Mobile) which can identify hidden SSID. How those tools are exactly working. How it is discovering hidden SSID WiFi beacons ?
- 1,287
3
votes
2
answers
1k
views
Fingerprinting servers behind firewall
I am currently testing some servers that are present behind a firewall. During the scanning I am unable identify which ports are open except port 80.
I have used various switches for Nmap only -Pn ...
- 271
0
votes
0
answers
4k
views
How to enumerate DCE services on open port 135?
I did a vulnerability scan on a machine and found a DCE Services Enumeration vulnerability. This is described as:
Distributed Computing Environment (DCE) services running on the remote host can be ...
- 235
1
vote
2
answers
3k
views
How can you enumerate an internal network with minimal outside knowledge?
The scenario is that you get to plug your laptop into an Ethernet port in some building. You get an IP address (DHCP) and can access the internet.
Right out of the gate you know your IP, gateway, ...
- 748
3
votes
1
answer
175
views
How dangerous is leaking knowledge about existence of objects which the user is not allowed to access?
It is my understanding that good security design does not reveal information about data which the user is not allowed to access. This includes information about the existence of said data, i.e. if a ...
- 672
6
votes
1
answer
1k
views
Are these encrypted URL values safe or could they be guessed?
One of our suppliers had a weakness on the secure section of his webpage. By changing ID's in the URL, we could see data that did not belong to us.
For example:
https://supplier.org/showItem.do?...
- 3,928
5
votes
1
answer
10k
views
Beyond Nmap: Investigating open TCP ports bound to unknown services
I have an uninvited guest using my private WLAN. At first I thought it was probably just a tech-savvy neighbour in need of Internet access, in which case; it wouldn't really bother me.
However, I've ...
- 1,749
8
votes
1
answer
499
views
Strange responses from an unfamiliar HTTP server
I noticed an unfamiliar device when scanning my local wireless network. It had two open (listening?) TCP ports; TCP/80 (http?) & TCP/443 (https?).
In an effort to identify the unfamiliar device;...
- 1,749
8
votes
6
answers
4k
views
Should I use a cryptograpically secure random number generator when I generate IDs?
It is common to generate random identifiers to expose through an API instead of using a simple auto incrementing primary key. The reasons are many:
Prevents easy enumeration.
Does not give away order ...
- 65.2k
7
votes
1
answer
6k
views
Informative error messages in password reset functionality? [duplicate]
When I am implementing password reset functionality I usually do not include informative messages about whether a user was found, because I have always believed that it can lead to user name ...
- 8,185
1
vote
3
answers
655
views
API Method Parameter Enumeration via Web Browser
I am obligated by contract to prevent enumeration of an API method's parameters but cannot achieve it.
When I send a blank request to the API server in a web browser, the server responds with the ...
- 19
0
votes
1
answer
89
views
Subdomain Bruteforcing when every request gets resolved?
Is it possible for an attacker to get a list of the subdomains configured for my server, if every subdomain request gets resolved?
In the case of a subdomain that doesn't exist, the server simply ...
- 41
2
votes
1
answer
619
views
NMAP's explicitely closed ports
I'm working on a challenge and I notice this odd output for a full port scan?
abc@desktop:~$ nmap -T5 -p- -sV x.x.x.x -PN
Interesting ports on x.x.x.x:
Not shown: 65533 filtered ports
PORT ...
- 1,437
1
vote
1
answer
427
views
Some questions about port-scans
I have two questions and it seems like this website is the perfect place to ask them.
I read a post earlier concerning port scans and one of the answers stated something along the lines of: "There is ...
- 95
9
votes
3
answers
17k
views
enumeration and MS DCERPC
Enumeration, enumeration, and even more enumeration is the generic pentesting mantra, but enumeration is worthless if you can't read the results.
I came across the Windows RPC service, where ...
- 704
1
vote
0
answers
418
views
How can a remote attacker find a user UID via Samba?
Is there a way to remotely retrieve the UID of a user via a Samba share?
I can get the user list with:
rpcclient -W 'WORKGROUP' -c querydispinfo -U''%'' '192.168.21.129' 2>&1
index: 0xa RID: ...
- 33.9k
2
votes
1
answer
173
views
Avoid brute-force enumeration of customers in a SaaS application
I'm involved in the development of a SaaS application. We host the application for different customers. A customer is a company. Each customer gets access to their hosted instance of the application ...
- 425
4
votes
3
answers
41k
views
Scan all possible files on server (Brute force Filenames)
I'm looking for a tool which can scan all possible filename combinations on a server and tells you what filenames the server responded to.
So it would try something like: example.com/a, example.com/b,...
- 43
10
votes
2
answers
2k
views
User Enumeration Vulnerability while creating Google account
When we create a Google account, Google tells us whether an account with specified username exists or not.
Doesn't that lead to user enumeration?
Why not let users fill other information first, ...
- 177
6
votes
1
answer
12k
views
Discovering a vulnerable service on a machine
I am trying to get access to one of the machines in my lab. it has 2 tcp ports that I am highly suspecting which are:
port 25 tcp
port 111 tcp
For port 25, it is supposed to be running SMTP, however,...
- 751
14
votes
4
answers
11k
views
Is username enumeration practical when the username is an email address?
From what I understand it is bad security practice to display informative failed login messages like:
The email you entered does not exist
Instead of
Incorrect email/password combination
...
- 8,185